# CVEs published 2015-10-23

71 CVEs were published on October 23, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5924](https://cve.now/CVE-2015-5924.md): The OpenGL implementation in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denia (no CVSS)
- [CVE-2015-5925](https://cve.now/CVE-2015-5925.md): The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2015-5926](https://cve.now/CVE-2015-5926.md): The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2015-5927](https://cve.now/CVE-2015-5927.md): FontParser in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2015-5928](https://cve.now/CVE-2015-5928.md): WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-5929](https://cve.now/CVE-2015-5929.md): WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-5930](https://cve.now/CVE-2015-5930.md): WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-5931](https://cve.now/CVE-2015-5931.md): WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial o (no CVSS)
- [CVE-2015-5932](https://cve.now/CVE-2015-5932.md): The kernel in Apple OS X before 10.11.1 allows local users to gain privileges by leveraging an unspecified "type confusion" during Mach task (no CVSS)
- [CVE-2015-5933](https://cve.now/CVE-2015-5933.md): Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2015-5934](https://cve.now/CVE-2015-5934.md): Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS)
- [CVE-2015-5935](https://cve.now/CVE-2015-5935.md): ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5936](https://cve.now/CVE-2015-5936.md): ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5937](https://cve.now/CVE-2015-5937.md): ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5938](https://cve.now/CVE-2015-5938.md): ImageIO in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2015-5939](https://cve.now/CVE-2015-5939.md): ImageIO in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5940](https://cve.now/CVE-2015-5940.md): The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validatio (no CVSS)
- [CVE-2015-5942](https://cve.now/CVE-2015-5942.md): FontParser in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2015-5943](https://cve.now/CVE-2015-5943.md): SecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching keychain windows, which allows attackers to bypas (no CVSS)
- [CVE-2015-5944](https://cve.now/CVE-2015-5944.md): CoreText in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2015-5945](https://cve.now/CVE-2015-5945.md): The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters. (no CVSS)
- [CVE-2015-6974](https://cve.now/CVE-2015-6974.md): IOHIDFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code in a privilege (no CVSS)
- [CVE-2015-6976](https://cve.now/CVE-2015-6976.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-6977](https://cve.now/CVE-2015-6977.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-6978](https://cve.now/CVE-2015-6978.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-6983](https://cve.now/CVE-2015-6983.md): Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app tha (no CVSS)
- [CVE-2015-6984](https://cve.now/CVE-2015-6984.md): libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink (no CVSS)
- [CVE-2015-6985](https://cve.now/CVE-2015-6985.md): Apple Type Services (ATS) in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memor (no CVSS)
- [CVE-2015-6987](https://cve.now/CVE-2015-6987.md): The File Bookmark component in Apple OS X before 10.11.1 allows local users to cause a denial of service (application crash) via crafted boo (no CVSS)
- [CVE-2015-6988](https://cve.now/CVE-2015-6988.md): The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers (no CVSS)
- [CVE-2015-6989](https://cve.now/CVE-2015-6989.md): Grand Central Dispatch in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-6990](https://cve.now/CVE-2015-6990.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-6991](https://cve.now/CVE-2015-6991.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-6993](https://cve.now/CVE-2015-6993.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-6994](https://cve.now/CVE-2015-6994.md): The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of s (no CVSS)
- [CVE-2015-6995](https://cve.now/CVE-2015-6995.md): The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code (no CVSS)
- [CVE-2015-6996](https://cve.now/CVE-2015-6996.md): IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cau (no CVSS)
- [CVE-2015-7002](https://cve.now/CVE-2015-7002.md): WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-7003](https://cve.now/CVE-2015-7003.md): coreaudiod in Audio in Apple OS X before 10.11.1 does not initialize an unspecified data structure, which allows attackers to execute arbitr (no CVSS)
- [CVE-2015-7006](https://cve.now/CVE-2015-7006.md): Directory traversal vulnerability in the BOM (aka Bill of Materials) component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS bef (no CVSS)
- [CVE-2015-7007](https://cve.now/CVE-2015-7007.md): Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execu (no CVSS)
- [CVE-2015-7008](https://cve.now/CVE-2015-7008.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-7009](https://cve.now/CVE-2015-7009.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-7010](https://cve.now/CVE-2015-7010.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-7011](https://cve.now/CVE-2015-7011.md): WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial o (no CVSS)
- [CVE-2015-7012](https://cve.now/CVE-2015-7012.md): WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-7013](https://cve.now/CVE-2015-7013.md): WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial o (no CVSS)
- [CVE-2015-7014](https://cve.now/CVE-2015-7014.md): WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-7015](https://cve.now/CVE-2015-7015.md): Heap-based buffer overflow in the DNS client library in configd in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allow (no CVSS)
- [CVE-2015-7016](https://cve.now/CVE-2015-7016.md): The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning prof (no CVSS)
- [CVE-2015-7018](https://cve.now/CVE-2015-7018.md): FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS)
- [CVE-2015-7019](https://cve.now/CVE-2015-7019.md): The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from ker (no CVSS)
- [CVE-2015-7020](https://cve.now/CVE-2015-7020.md): The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from ker (no CVSS)
- [CVE-2015-7021](https://cve.now/CVE-2015-7021.md): The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memor (no CVSS)
- [CVE-2015-7023](https://cve.now/CVE-2015-7023.md): CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cooki (no CVSS)
- [CVE-2015-6975](https://cve.now/CVE-2015-6975.md): CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-6979](https://cve.now/CVE-2015-6979.md): GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory cor (no CVSS)
- [CVE-2015-6981](https://cve.now/CVE-2015-6981.md): WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption a (no CVSS)
- [CVE-2015-6982](https://cve.now/CVE-2015-6982.md): WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption a (no CVSS)
- [CVE-2015-6986](https://cve.now/CVE-2015-6986.md): com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a craft (no CVSS)
- [CVE-2015-6992](https://cve.now/CVE-2015-6992.md): CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-6997](https://cve.now/CVE-2015-6997.md): The X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the kSecRevocationRequirePositiveResponse flag im (no CVSS)
- [CVE-2015-6999](https://cve.now/CVE-2015-6999.md): The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by (no CVSS)
- [CVE-2015-7000](https://cve.now/CVE-2015-7000.md): Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attacker (no CVSS)
- [CVE-2015-7004](https://cve.now/CVE-2015-7004.md): The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app. (no CVSS)
- [CVE-2015-7005](https://cve.now/CVE-2015-7005.md): WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption a (no CVSS)
- [CVE-2015-7017](https://cve.now/CVE-2015-7017.md): CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-7022](https://cve.now/CVE-2015-7022.md): The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app. (no CVSS)
- [CVE-2015-7030](https://cve.now/CVE-2015-7030.md): The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors. (no CVSS)
- [CVE-2015-7031](https://cve.now/CVE-2015-7031.md): The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers t (no CVSS)
- [CVE-2015-7035](https://cve.now/CVE-2015-7035.md): Apple Mac EFI before 2015-002, as used in OS X before 10.11.1 and other products, mishandles arguments, which allows attackers to reach "unu (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-10-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.